# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=347 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 348 --- ## [Can Elasticsearch automatically normalize vectors for dot\_product?](https://discuss.elastic.co/t/can-elasticsearch-automatically-normalize-vectors-for-dot-product/349151)
**Author:** [@mmaccou](https://discuss.elastic.co/u/mmaccou)\ **Replies:** 7\ **Last updated:** [December 19, 2023, 10:01pm UTC](https://discuss.elastic.co/t/can-elasticsearch-automatically-normalize-vectors-for-dot-product/349151 "2023-12-19T22:01:28Z")
Can Elasticsearch automatically normalize vectors for dot\_product? I haven't found it the docs yet, but wanted to double check here before I manually add the step in my code. --- ## [Fixing query for type ahead with more than one query term](https://discuss.elastic.co/t/fixing-query-for-type-ahead-with-more-than-one-query-term/349564)
**Author:** [@RodAndTom](https://discuss.elastic.co/u/RodAndTom)\ **Replies:** 2\ **Last updated:** [December 19, 2023, 9:20pm UTC](https://discuss.elastic.co/t/fixing-query-for-type-ahead-with-more-than-one-query-term/349564 "2023-12-19T21:20:34Z")
Hi, I'm currently using the following query to suggest terms for type ahead completion for a title field, and it suits me very well: GET transcricoes/\_search { "query": { "wildcard": { "name": { "va… --- ## [What happens on shutdown if queue.drain is true but output is unavailable?](https://discuss.elastic.co/t/what-happens-on-shutdown-if-queue-drain-is-true-but-output-is-unavailable/349680)
**Author:** [@noobiewan](https://discuss.elastic.co/u/noobiewan)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 7:29pm UTC](https://discuss.elastic.co/t/what-happens-on-shutdown-if-queue-drain-is-true-but-output-is-unavailable/349680 "2023-12-19T19:29:44Z")
Hi there, I'm currently running Logstash on Kubernetes and have configured a pipeline with a Persistent Queue and the setting queue.drain: true. In this setup, I'm curious about Logstash's behavior when it receives a SI… --- ## [How do I get to know that reindexing has been completed in Elasticsearch python client?](https://discuss.elastic.co/t/how-do-i-get-to-know-that-reindexing-has-been-completed-in-elasticsearch-python-client/349670)
**Author:** [@Aditya\_Dubey](https://discuss.elastic.co/u/Aditya_Dubey)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 7:22pm UTC](https://discuss.elastic.co/t/how-do-i-get-to-know-that-reindexing-has-been-completed-in-elasticsearch-python-client/349670 "2023-12-19T19:22:18Z")
Basically, I'm running a reindexing function, and immediately after that, I'm running a function to delete the source index. Python runs all lines of code for the first function and moves to the next function (delete ind… --- ## [IF Regex not working](https://discuss.elastic.co/t/if-regex-not-working/349648)
**Author:** [@marcowiskhy](https://discuss.elastic.co/u/marcowiskhy)\ **Replies:** 5\ **Last updated:** [December 19, 2023, 5:51pm UTC](https://discuss.elastic.co/t/if-regex-not-working/349648 "2023-12-19T17:51:51Z")
Hey guys, In my pipeline I use a dictionary to enrich internal IPs and, to capture, I use the following regex: if \[source\] =~ "^10\\." or \[source\] =~ "^127\\.0\\." or \[source\] =~ "^192\\.168\\." or \[source\] =~ "^172\\.(1\[678… --- ## [Get integration assets](https://discuss.elastic.co/t/get-integration-assets/349647)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 3\ **Last updated:** [December 19, 2023, 5:22pm UTC](https://discuss.elastic.co/t/get-integration-assets/349647 "2023-12-19T17:22:08Z")
Is there a way to get the list of elasticsearch assets for a given elastic integration (From kibana or from an API). I am trying to figure out the list of: index templates, component templates, transforms, pipelines ma… --- ## [Allowing long query to complete even if indexes are shriking](https://discuss.elastic.co/t/allowing-long-query-to-complete-even-if-indexes-are-shriking/349273)
**Author:** [@DidierB](https://discuss.elastic.co/u/DidierB)\ **Replies:** 4\ **Last updated:** [December 19, 2023, 5:14pm UTC](https://discuss.elastic.co/t/allowing-long-query-to-complete-even-if-indexes-are-shriking/349273 "2023-12-19T17:14:40Z")
Hello, I have a use case with up to two billions events a day that are injected into an Elasticsearch. I opimized by making one index per hour (4 primary shards with 1 replica per shard) and setting a index lifecycle po… --- ## [Elastic Agent Cisco ASA integration - timestamp issue](https://discuss.elastic.co/t/elastic-agent-cisco-asa-integration-timestamp-issue/349646)
**Author:** [@vuylstekeb](https://discuss.elastic.co/u/vuylstekeb)\ **Replies:** 5\ **Last updated:** [December 19, 2023, 5:01pm UTC](https://discuss.elastic.co/t/elastic-agent-cisco-asa-integration-timestamp-issue/349646 "2023-12-19T17:01:35Z")
Hi I've recently started experimenting with Elastic Agent integrations. I've added one for Cisco ASA logs. The problem I'm facing is that my data is coming in with wrong timestamps. The data gets added into the indice wi… --- ## [Failed to submit a listener notification task. Event loop shut down? java.util.concurrent.RejectedExecutionException: event executor terminated](https://discuss.elastic.co/t/failed-to-submit-a-listener-notification-task-event-loop-shut-down-java-util-concurrent-rejectedexecutionexception-event-executor-terminated/349623)
**Author:** [@Kelvin\_A\_Escobar\_Mor](https://discuss.elastic.co/u/Kelvin_A_Escobar_Mor)\ **Replies:** 2\ **Last updated:** [December 19, 2023, 4:28pm UTC](https://discuss.elastic.co/t/failed-to-submit-a-listener-notification-task-event-loop-shut-down-java-util-concurrent-rejectedexecutionexception-event-executor-terminated/349623 "2023-12-19T16:28:51Z")
Failed to submit a listener notification task. Event loop shut down? java.util.concurrent.RejectedExecutionException: event executor terminated at io.netty.util.concurrent.SingleThreadEventExecutor.reject(SingleThreadE… --- ## [Unstable operation of elasticsearch](https://discuss.elastic.co/t/unstable-operation-of-elasticsearch/345931)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 19\ **Last updated:** [December 19, 2023, 2:14pm UTC](https://discuss.elastic.co/t/unstable-operation-of-elasticsearch/345931 "2023-12-19T14:14:15Z")
Hi Team! Recently I began to notice unstable operation of Logstash, I started looking at the logs (I have two Logstash nodes). Here is an example of logs: Oct 27 07:01:17 v-elk-lst01.my logstash\[42023\]: \[2023-10-27T07:… --- ## [Is indexing with HNSW required for kNN to work?](https://discuss.elastic.co/t/is-indexing-with-hnsw-required-for-knn-to-work/349598)
**Author:** [@mmaccou](https://discuss.elastic.co/u/mmaccou)\ **Replies:** 3\ **Last updated:** [December 19, 2023, 3:36pm UTC](https://discuss.elastic.co/t/is-indexing-with-hnsw-required-for-knn-to-work/349598 "2023-12-19T15:36:26Z")
While setting up some search templates for kNN, I discovered HNSW and the parameters for index options. "index\_options": { "type": "hnsw", "m": 32, "ef\_construction": 100 } When in… --- ## [Consolidate filebeats](https://discuss.elastic.co/t/consolidate-filebeats/349653)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 1:55pm UTC](https://discuss.elastic.co/t/consolidate-filebeats/349653 "2023-12-19T13:55:32Z")
Hi - we have a situation where different log files are being sent to diff logstash outputs and it's getting out of control with more than 7-8 instances running at the moment on a bunch of the key servers. I am trying to … --- ## [About Logstash configuration using ssl](https://discuss.elastic.co/t/about-logstash-configuration-using-ssl/349628)
**Author:** [@Hamada](https://discuss.elastic.co/u/Hamada)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 12:59pm UTC](https://discuss.elastic.co/t/about-logstash-configuration-using-ssl/349628 "2023-12-19T12:59:12Z")
I have a question regarding Logstash configuration. In order to connect to Elasticsearch from Logstash, enter the following into the Logstash configuration and execute. == output{ elasticsearch { hosts =\> \["https://… --- ## [I configure rsyslog for my linux server now I want to send logs to LOGSTASH. How could I achieve that](https://discuss.elastic.co/t/i-configure-rsyslog-for-my-linux-server-now-i-want-to-send-logs-to-logstash-how-could-i-achieve-that/349566)
**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Replies:** 4\ **Last updated:** [December 19, 2023, 12:52pm UTC](https://discuss.elastic.co/t/i-configure-rsyslog-for-my-linux-server-now-i-want-to-send-logs-to-logstash-how-could-i-achieve-that/349566 "2023-12-19T12:52:08Z")
Below is my rsyslog conf. My audit logs are generating in syslogs only. --- ## [Logstash split log base on space and =](https://discuss.elastic.co/t/logstash-split-log-base-on-space-and/348526)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 2\ **Last updated:** [December 19, 2023, 11:51am UTC](https://discuss.elastic.co/t/logstash-split-log-base-on-space-and/348526 "2023-12-19T11:51:39Z")
I want to separate below log in Logstash, I know that we can do it by grok filter, but is there any way to do it without grok? Log: date=2023-12-04 time=11:26:01 my\_id=5646875 dir="D" type=ML severety=info mtype="my lo… --- ## [Discovery-EC2 - master not discovered yet, this node has not previously joined a bootstrapped cluster, and \[cluster.initial\_master\_nodes\] is empty on this node: have discovered](https://discuss.elastic.co/t/discovery-ec2-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-cluster-and-cluster-initial-master-nodes-is-empty-on-this-node-have-discovered/349493)
**Author:** [@lakshmikandan](https://discuss.elastic.co/u/lakshmikandan)\ **Replies:** 4\ **Last updated:** [December 19, 2023, 10:15am UTC](https://discuss.elastic.co/t/discovery-ec2-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-cluster-and-cluster-initial-master-nodes-is-empty-on-this-node-have-discovered/349493 "2023-12-19T10:15:30Z")
Version: 8.11.0, Build: rpm/d9ec3fa628c7b0ba3d25692e277ba26814820b20/2023-11-04T10:04:57.184859352Z, JVM: 21.0.1 \[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[ip-10-10-10-1.us-west-2.compute.internal\] master not disco… --- ## [Monitoring new users on Linux with Auditbeat](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647)
**Author:** [@DominikStejskal](https://discuss.elastic.co/u/DominikStejskal)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 9:42am UTC](https://discuss.elastic.co/t/monitoring-new-users-on-linux-with-auditbeat/348647 "2023-12-19T09:42:45Z")
Hello, we are trying to monitor the creation of new user accounts on Linux machines with Auditbeat (7.17). We would like to know the names of the newly created users. Creating a new user shows up in Kibana as an event f… --- ## [Kibana is unable to display metrics on kibana discover tab](https://discuss.elastic.co/t/kibana-is-unable-to-display-metrics-on-kibana-discover-tab/349637)
**Author:** [@skumarya](https://discuss.elastic.co/u/skumarya)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 9:04am UTC](https://discuss.elastic.co/t/kibana-is-unable-to-display-metrics-on-kibana-discover-tab/349637 "2023-12-19T09:04:46Z")
we were using 7.16 elasticsearch,kibana and filebeat verison earlier which used to scrap metrics and displayed in the kibana discover tab but when upgraded to 8.8.0 it doesn't display elastic,kibana and filebeat yaml fi… --- ## [Can I use PHP Elasitcsearch client version 8 for Elasticsearch cluster version 7](https://discuss.elastic.co/t/can-i-use-php-elasitcsearch-client-version-8-for-elasticsearch-cluster-version-7/349631)
**Author:** [@yoss\_fazwaz](https://discuss.elastic.co/u/yoss_fazwaz)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 8:04am UTC](https://discuss.elastic.co/t/can-i-use-php-elasitcsearch-client-version-8-for-elasticsearch-cluster-version-7/349631 "2023-12-19T08:04:43Z")
I am currently using Elasticsearch cluster version 7.17.7 and Elasticsearch client version 7.17.1. However, I want to upgrade the Elasticsearch client to version 8.11. Will Elasticsearch client version 8.11 function pro… --- ## [How should I configure TLS?](https://discuss.elastic.co/t/how-should-i-configure-tls/349431)
**Author:** [@Hamada](https://discuss.elastic.co/u/Hamada)\ **Replies:** 3\ **Last updated:** [December 19, 2023, 7:14am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431 "2023-12-19T07:14:02Z")
I don't know how to set up a certificate to connect Winlogbeat to Elasticsearch via https. What should I do to create a PEM file from the CA (http.p12) created at initial startup? I don't understand what is required in… --- ## [Filebeat stops pusing the logs to logstash](https://discuss.elastic.co/t/filebeat-stops-pusing-the-logs-to-logstash/349627)
**Author:** [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 7:03am UTC](https://discuss.elastic.co/t/filebeat-stops-pusing-the-logs-to-logstash/349627 "2023-12-19T07:03:28Z")
/// I'm pushing windows DHCP logs to linux logstash it sends the logs but after sometime it stops sending the logs again when I delete the registry file start with filebeat -e -c filebeat.yml It starts sending logs but … --- ## [\[2023-12-19T02:08:38,809\]\[ERROR\]\[i.n.u.c.D.rejectedExecution\] \[data\_node4\] Failed to submit a listener notification task. Event loop shut down? java.util.concurrent.RejectedExecutionException: event executor terminated](https://discuss.elastic.co/t/2023-12-19t0238-809-error-i-n-u-c-d-rejectedexecution-data-node4-failed-to-submit-a-listener-notification-task-event-loop-shut-down-java-util-concurrent-rejectedexecutionexception-event-executor-terminated/349620)
**Author:** [@Kelvin\_A\_Escobar\_Mor](https://discuss.elastic.co/u/Kelvin_A_Escobar_Mor)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 6:15am UTC](https://discuss.elastic.co/t/2023-12-19t0238-809-error-i-n-u-c-d-rejectedexecution-data-node4-failed-to-submit-a-listener-notification-task-event-loop-shut-down-java-util-concurrent-rejectedexecutionexception-event-executor-terminated/349620 "2023-12-19T06:15:39Z")
\[2023-12-19T02:08:38,809\]\[ERROR\]\[i.n.u.c.D.rejectedExecution\] \[data\_node4\] Failed to submit a listener notification task. Event loop shut down? java.util.concurrent.RejectedExecutionException: event executor terminated … --- ## [How to mock handlers for elastic search client v8.11.0](https://discuss.elastic.co/t/how-to-mock-handlers-for-elastic-search-client-v8-11-0/349614)
**Author:** [@yoss\_fazwaz](https://discuss.elastic.co/u/yoss_fazwaz)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 5:30am UTC](https://discuss.elastic.co/t/how-to-mock-handlers-for-elastic-search-client-v8-11-0/349614 "2023-12-19T05:30:56Z")
Hi, guys, I have updated my Elasticsearch client from V7 to V8, and it seems that the setHandler is removed. I have no idea how to set it in version 8. --- ## [Dissect in logstash and tabs](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595)
**Author:** [@astateofmind](https://discuss.elastic.co/u/astateofmind)\ **Replies:** 3\ **Last updated:** [December 19, 2023, 2:29am UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595 "2023-12-19T02:29:56Z")
Trying to use dissect to add log.level field to some beats. Using filebeat to send the data and some logs have their fields separated by tabs instead of spaces. The logs with space work ok with this filter: "%{} %{log… --- ## [Kibana 5601 port protocol & cipher can't detected](https://discuss.elastic.co/t/kibana-5601-port-protocol-cipher-cant-detected/349613)
**Author:** [@Septianingrum.17](https://discuss.elastic.co/u/Septianingrum.17)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 3:39am UTC](https://discuss.elastic.co/t/kibana-5601-port-protocol-cipher-cant-detected/349613 "2023-12-19T03:39:00Z")
I just did a vulnerability scan and got the issue "SSH in Elastic server CBC Mode Ciphers Enabled" this vulnerability was detected on the Kibana server. I have changed the server.ssl.cipherSuites and server.ssl.supporte… --- ## [Elasticsearch Input on Logstash](https://discuss.elastic.co/t/elasticsearch-input-on-logstash/349609)
**Author:** [@Leonadius](https://discuss.elastic.co/u/Leonadius)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 3:04am UTC](https://discuss.elastic.co/t/elasticsearch-input-on-logstash/349609 "2023-12-19T03:04:23Z")
Dear Elastic Team, I have a case where i need to sync all of the documents from 1 index to another elastic cluster with near real-time. I'm thinking using logstash elasticsearch input to read all of the documents conti… --- ## [Should I deploy elasticsearch in docker on one machine?](https://discuss.elastic.co/t/should-i-deploy-elasticsearch-in-docker-on-one-machine/349115)
**Author:** [@sigmastar](https://discuss.elastic.co/u/sigmastar)\ **Replies:** 13\ **Last updated:** [December 19, 2023, 2:06am UTC](https://discuss.elastic.co/t/should-i-deploy-elasticsearch-in-docker-on-one-machine/349115 "2023-12-19T02:06:57Z")
I wanna achive the best performance for Elasticsearch on a single machine. But right now, I'm running three Elasticsearch instance in docker on only one machine. Shoud I keep this for better performance or I should deplo… --- ## [Issue in Advanced Sync Rules for JOIN Query](https://discuss.elastic.co/t/issue-in-advanced-sync-rules-for-join-query/349605)
**Author:** [@aisyaharifin](https://discuss.elastic.co/u/aisyaharifin)\ **Replies:** 0\ **Last updated:** [December 19, 2023, 1:47am UTC](https://discuss.elastic.co/t/issue-in-advanced-sync-rules-for-join-query/349605 "2023-12-19T01:47:12Z")
Hi Elastic, I have a question to ask where I've encountered issue with the Advanced Sync Rules Query : So I have an application lets call it myStaff, where I've been pulling multiple tables from the db using Microso… --- ## [Validation Failed: 1: this action would add \[8\] total shards, but this cluster currently has \[3997\]/\[4000\] maximum shards open](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-8-total-shards-but-this-cluster-currently-has-3997-4000-maximum-shards-open/349527)
**Author:** [@HyebinHong](https://discuss.elastic.co/u/HyebinHong)\ **Replies:** 5\ **Last updated:** [December 18, 2023, 11:12pm UTC](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-8-total-shards-but-this-cluster-currently-has-3997-4000-maximum-shards-open/349527 "2023-12-18T23:12:26Z")
Hello, Elastic! I'm facing the trouble while indexing data. I run both ES 8.11 and OpenSearch 2.11 but both have same issues. Please help me. I found out my shards had reached the maximum(1000 shards per nodes). My da… --- ## [Secure ELK Stack with cloudflare wildcard SSL Failing on an ubuntu setup](https://discuss.elastic.co/t/secure-elk-stack-with-cloudflare-wildcard-ssl-failing-on-an-ubuntu-setup/349597)
**Author:** [@gurungo\_lovemore](https://discuss.elastic.co/u/gurungo_lovemore)\ **Replies:** 0\ **Last updated:** [December 18, 2023, 8:58pm UTC](https://discuss.elastic.co/t/secure-elk-stack-with-cloudflare-wildcard-ssl-failing-on-an-ubuntu-setup/349597 "2023-12-18T20:58:57Z")
I have a cloudflare wildcard ssl for my organization that i have configured on my elasticsearch and Kibana as follows: ''''''''' Elasticsearch # Enable security features xpack.security.enabled: true xpack.security.en… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=346) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=348)